[Motorola Droid X2] dragonzkiller:
As of you guys have found out there has been a few threads that have been started that throw around theories about getting CWMR to work and such and I'm here to finally give you guys the progress from the dev that's working on it.

I have been working on getting CWMR working off and on for a few months now to some avail. I have been slowly testing it and sending out alphas to people on the IRC and now I'm here to tell you where I'm at and what has been accomplished.

Part 1: Getting into CWMR

I started working with our current bootstrap recovery as a base for CWMR. It was of course in charge mode, but it was a step that had to be done first. I got a hold on a CWMR binary and after a bunch of shell commands managed to get the mangled version of CWMR that we've seen before. From there I had the idea to inject the ATRIX binary into the recovery and try it from there. It was a big success and I could use some (very few) of the functions that if offered. But I was finally in CWMR on the X2. (I posted the picture on my twitter).

Part 2: Making the Functions Work

From here the first thing I decided to do was to get the "Fix Permissions" script working. By getting this to work I know I could place my own code in there that will log to the file that I could open up and see whatever I wanted as ADB didn't work YET (more on that later). I fiddled with it a bit and got it working.

This also allowed me to access the log and find out why the unmounting and formatting wasn't working either. This was due to an issue with the mke2fs and other complementary binaries not being appropriately compiled for our phone. As I was working on CM7 at the time, i had access to the sources of these and to the recovery binary as well. I decided to build a recovery binary that was tailored to our phone and not the ATRIX and the binaries that handle formatting partitions, etc. These worked on some partitions I could wipe data and cache properly by reformatting, I could easily erase a partition at will except for one: /system.

Part 3: Getting /system Formatted (WIP)

At this point I decided to find out why /system could never be formatted. When a partition needs formatting it must be unmounted first. But I could never unmount /system. By using the logs I found out that the partition was still in use. By using the "Fix Permissions" script, I managed to find that a lot of daemons (aka services) were being ran from the /system sub directories. This meant that in order to format, I had to have them not running. Easy enough as there's a script in CWMR that allows us to kill certain processes before the new recovery starts. I decided to kill all of the services with this script but found that the display would go blank. From there I found that two services are REQUIRED to be running on the phone for drawing (making things show on the screen) to take place: servicemanager and nvrm_daemon.

The servicemanager does exactly what it's title says: it manages the currently running services. This has to be running to keep nvrm_daemon running or else things get kinda freaky.

nvrm_daemon is what is used to manage drawing commands to the screen (the nv stands for nVidia which is who made the Tegra 2). With this service running I was able to (while in charge mode still) draw to the screen and show all of the menus for CWMR.

This created a problem. As these HAD to be running /system could never unmount because they were in there. Unless we used 2nd-init. From here I created my own hijack script that allowed me to copy over the necessary daemons into /sbin (which is just a sub directory of the rootfs). Then by using a new init.rc I could start these daemons from /sbin and see if they worked for CWMR.

After a lot of coding I managed to get the daemons running from /sbin and I thought I was free from there. And while I was at it, I might as well tried to get it out of charge mode.

Part 4: Untethering the Recovery (WIP)

I figured that since I was using 2nd-init anyway that I might as well have been working on trying to get it untethered also. After a bunch of looking into why charge mode was the only way to get it working, I found that before charge mode was started the init.rc started the "pre-zygote" services. These include usbd (the usb daemon), battd (the battery daemon), etc. What was also started was nvrm_daemon (another proof that we needed this running) to draw on the screen (charge mode draws the battery indicator to show charging progress).

I decided to move to mot_boot_mode to do the hijacking. I eventually managed to get things running but it still wouldn't draw to the screen. A look at the logs showed that for whatever reason we still didn't have access to the framebuffer (the memory space aka buffer that is drawn to the screen). I was tired of rebooting over and over again to get results and by now I had SBF'd I don't know how many times, only to not be able to access the logs due to a wipe. So next thing I decided was to get ADB working at boot.

Part 5: Starting ADB at Boot (The Short Version)

I took a look through the init.rc and found that Motorola had disabled the default way to get ADB working at boot. Through a bunch of digging I found that I could re-enable the method but it started usbd also (yet another daemon I'd have to move and thus more time, etc.). But eventually I found another property (aka system variable) that i could set that would start ADB without having usbd started: persist.adb.enable_NV_DISABLED. Setting that to 1 started ADB whenever I wanted it to. This allowed me access to the system (as root actually) without having to reboot and try to get into logs and whatnot. I could see everything that was running, mount/unmount and do everything I normally could and see better why they were failing.

Part 6: Recent Discoveries (as of 1/3/12) On the /system Unmount

I decided that I was going to go back to charge mode for now. After causing too much pain with framebuffer access I decided to look into why /system STILL wouldn't unmount after moving everything out of there. With the help of mastafunk and DrPenguin I was able to get a hold of a program named strace. This allows you to debug what binaries are doing down to pretty much every comparison, file opening, memory mapping, etc. I had found that nvrm_daemon (although started from /sbin) was looking for and loading drivers found in /system/lib. This was a problem and I thought that we may never get /system unmounted. Until I found out one other thing.

The nvrm_daemon doesn't look for the drivers inside of /system/lib first. It looks for them in /vendor/lib first and then if it can't find them, goes to /system/lib. So simple enough. I thought I could just make a /vendor/lib directory, copy the libs over and have them load from there. Well it's not that simple as there is already a file in the rootfs named vendor. But the file is a symlink to /system/vendor so if it looks at /vendor/lib it really looks at /system/vendor/lib. I thought I was stuck again until I took a closer look at the /system directory. There is no ./vendor sub directory in /system. That being said, I was able to delete the symlink in the rootfs and then create a /vendor/lib directory copy over the libs to it and nvrm_daemon successfully loaded the libs from there and not from system.

Conclusion

You are now caught up on when we've basically done to try to get CWMR working on the X2. Being that we're the only Tegra 2 phone from Motorola that is locked, we're kinda stuck trying to get things working. For now I consider this progress. Albeit slow progress, but progress none the less. If you took the time to read this, I hope you now understand the frustrations I've had to deal with this. All the while trying to help masta get 2nd-init fully working for our phones.

Thank you.